Privacy Notice

How we collect pupil information

We collect pupil information from you directly or via registration forms at the start of the school year or Common Transfer File (CTF) or secure file transfer from previous school or nursery.

Pupil data is essential for the schools’ operational use. Whilst the majority of pupil information you provide to us is mandatory, some of it requested on a voluntary basis. In order to comply with the data protection legislation, we will inform you at the point of collection, whether you are required to provide certain pupil information to us or if you have a choice in this and we will tell you what you need to do if you do not want to share this information with us.

Why we collect and use pupil information

Our main legal bases for collecting and processing this information are:

• Legal obligation: the processing is necessary for us to comply with the law
• Public task: the processing is necessary for us to perform a task in the public interest or for our official functions

The personal data collected is essential, for the school to fulfil their official functions and meet legal requirements.

Occasionally we may also use this information where:

• you have given your explicit consent for us to process this personal information
• we need to protect your child’s vital interests

We collect and use pupil information, for the following purposes:

1. to support pupil learning
2. to monitor and report on pupil attainment progress
3. to provide appropriate pastoral care, welfare and health services
4. to assess the quality of our services
5. to keep children safe (food allergies, or emergency contact details)
6. to meet the statutory duties placed upon us by Welsh Assembly Government

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing pupil information are:

Art 6 (1)(c) processing is necessary for compliance with a legal obligation to which the controller is subject;

Art 6 (1)(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

Article 9 under the UK GDPR for processing of Special Category Data:

9(a) The data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;

processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects;

 

We process your information to determine applications for admission to school in accordance with

• Education Act 1996,
• Childrens Act 1989

The categories of pupil information that we process:

• Personal details such as name, address, date of birth, child/young person identifiers and contact details for parents and guardians;
• Information on any special educational needs;
• Information on performance in internal and national assessments and examinations;
• Information on the ethnic origin and national identity of children and young people (this is used only to prepare summary statistical analyses);
• Details about children’s and young people’s immigration status (this is used only to prepare summary statistical analyses);
• Medical information needed to keep children and young people safe while in our care
• Information on attendance and any disciplinary action taken;
• Information about the involvement of social services with individual children and young people where this is needed for the care of the child/young person

How we store pupil data

To ensure our pupil information is kept safe we have the following controls/limitations in place:

• the information will not be used for any purpose other than those stated in this notice
• the information will be held within secure systems/locations, with appropriate levels of security, that comply with relevant data protection legislation
• the information will only be shared for lawful purposes and with an appropriate level of security that complies with relevant data protection legislation
• the information will only be held for the periods agreed in Newport City Council’s Retention Schedule, after which it will be destroyed. The Retention Schedule is available on request
• the information will be held, used and shared in accordance with the Data Protection Act 2018 and the General Data Protection Regulation.

Who we share pupil information with

We routinely share pupil information with:

• Schools that pupils attend after leaving us
• Newport City Council
• The Education Achievement Service (EAS)
• Aneurin Bevan University Health Board (school health checks)
• Welsh Assembly Government
• The Department for Education
• Edukey
• ParentPay
• SIMS
• Seesaw
• Evolve
• Residential Outdoor Education Centres
• Colorfoto/Photographer
• SRS
• Parentmail
• Mathletics
• Pearson Education
• HWB

Why we share pupil information

We do not share information about our pupils with anyone without consent unless the law and our policies allow us to do so. When you give your consent for your child’s information to be held and/or shared for any purpose, you can withdraw that consent at any time, by contacting the Data Protection Officer named above.

We are required, by law, to pass certain information about our pupils to Newport City Council and Welsh Government. Welsh Government will only provide data for a specific purpose and for a limited time period, after which the organisation must confirm that it has been destroyed. Any analysis produced must follow Welsh government disclosure rules to ensure that individual pupils cannot be identified. For research purposes wider than education, Welsh Government will use techniques that ensure the data are anonymised before any research takes place. Sharing of anonymised data is outside of the UK GDPR.

How long is the information kept?

The data will be kept until the pupil’s 25th birthday or for the duration of the criteria which underpin the statutory regulation. After this point the data will be securely destroyed or may be anonymised in line with best practices and used only for statistical and research purposes.

Requesting access to your personal data

The UK-GDPR gives parents and pupils certain rights about how their information is collected and used. To make a request for your personal information, or be given access to your child’s educational record, contact stjosephsrc.primary@newportschools.wales

You have the following rights:

• the right to be informed about the collection and use of your personal data – this is called ’right to be informed’.
• the right to ask us for copies of your personal information we have about you – this is called ’right of access’, this is also known as a subject access request (SAR), data subject access request or right of access request.
• the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’.
• the right to ask us to delete your personal information – this is called ‘right to erasure’
• the right to ask us to stop using your information – this is called ‘right to restriction of processing’.
• the ‘right to object to processing’ of your information, in certain circumstances
• rights in relation to automated decision making and profiling.
• the right to withdraw consent at any time (where relevant).

Withdrawal of consent and the right to lodge a complaint

If we are relying on your consent to process your data, you have the right to withdraw your consent to this processing at any point. If you are unhappy with the way the school is using your data, you have the right to complain to us. 

 

If you would like to do this, please contact the school on stjosephsrc.primary@newportschools.wales

 

 

If you are not content with the subsequent outcome of your complaint, you may apply directly to the Information Commissioner for a decision. Generally, the ICO cannot make a decision unless you have exhausted our complaints procedure. The Information Commissioner can be contacted at:

 

The Information Commissioners Office,

Wycliffe House, Water Lane,

Wilmslow,

Cheshire

SK9 5AF.

 

Data Protection Officer

Mrs Tara Lynch is the Data Controller and the Data Protection Officer is: Mark Bleazard mark.bleazard@newport.gov.uk

Digital Services Manager

Newport City Council

Civic Centre

Newport

NP20 4UR

Email: information.management@newport.gov.uk

Tel: 01633 656656

School Contact Information

Headteacher – Mrs Tara Lynch - 01633 631658

Main school email - stjosephs.rc.primary@newportschools.wales

School Support Officer – Mrs Teresa Conlon

 

Last updated

We may need to update this privacy notice periodically so we recommend that you revisit this information from time to time. This version was last updated on 14^th January 2026

Cookies Used

Necessary

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms.

You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.